Study. uk . com
  1. Home
  2. All questions
  3. Question 410

CISSP study material · question 410 of 500

An agency writes its continuous monitoring strategy solely around individual systems. What does NIST SP 800-137 expect?

  1. A strategy at the system tier only, with the other tiers covered by the risk assessment.
  2. A strategy at the organisation tier only, with system detail left to control assessors.
  3. A strategy at all three tiers: the organisation, its mission and business processes, and the individual system.
  4. A single strategy per authorisation boundary, regardless of tier.
Show the answer

Answer: C. A strategy at all three tiers: the organisation, its mission and business processes, and the individual system.

SP 800-137 defines the monitoring strategy at the organisation and mission or business process tiers as well as at the individual information system tier.

Source: NIST SP 800-137 (NIST) — SP 800-137 > 3.1 Define ISCM Strategy

Challenge yourself on this topic → Study as cards